AWS solutions documentation change
Summary
Expanded documentation about blueprint deployment events and clarified component roles in account lifecycle
Security assessment
Adds details about event-driven workflows but doesn't introduce or modify security controls. Security-related aspects (IAM Identity Center access, OU moves) were already documented.
Diff
diff --git a/solutions/latest/innovation-sandbox-on-aws/event-infra.md b/solutions/latest/innovation-sandbox-on-aws/event-infra.md index 1a5668d3a..d451df72d 100644 --- a//solutions/latest/innovation-sandbox-on-aws/event-infra.md +++ b//solutions/latest/innovation-sandbox-on-aws/event-infra.md @@ -21 +21 @@ Producers: - * The **account lifecycle** Lambda produces an event to start the account clean-up process after an account has been successfully moved to the CleanUp OU. + * The **account lifecycle** Lambda produces an event to start the account clean-up process after an account has been successfully moved to the CleanUp OU, and produces blueprint deployment request events when a lease with an attached blueprint is approved. @@ -23 +23,3 @@ Producers: - * The account cleaner AWS Step Functions (state machine) emits an event once an account has been processed. + * The **account cleaner** AWS Step Functions (state machine) emits an event once an account has been processed. + + * The **blueprint deployment** Step Functions (state machine) emits success or failure events once a blueprint deployment process has been completed. @@ -30 +32 @@ Consumers: - * The **account lifecycle** function receives events from the account cleaner and lease monitoring Lambdas to move accounts from lifecycle state to another. This process involves moving the account between OUs, updating the state in DynamoDB, and revoking/granting user access to an account within the IAM Identity Center. + * The **account lifecycle** function receives events from the account cleaner, blueprint deployment, and lease monitoring Lambdas to move accounts from one lifecycle state to another. This process involves moving the account between OUs, updating the state in DynamoDB, and revoking/granting user access to an account within the IAM Identity Center. @@ -32 +34 @@ Consumers: - * The account cleaner function receives events indicating that an account should be processed for clean-up. + * The **account cleaner** function receives events indicating that an account should be processed for clean-up. @@ -34 +36 @@ Consumers: - * The email notification Lambda receives events from all producers and sends human readable emails to the appropriate users, managers, and administrators for the event. This Lambda uses [Amazon Simple Email Service (SES)](https://aws.amazon.com/ses/) for these notifications. It is expected that customers will configure this outside of the solution deployment. + * The **email notification** Lambda receives events from all producers and sends human readable emails to the appropriate users, managers, and administrators for the event. This Lambda uses [Amazon Simple Email Service (SES)](https://aws.amazon.com/ses/) for these notifications. It is expected that customers will configure this outside of the solution deployment.